Slashdot Mirror
New Linux Trojan Can Spy on Users by Taking Screenshots and Recording Audio (drweb.com)
An anonymous reader writes: Dr.Web, a Russian antivirus maker, has detected a new threat against Linux users: the Linux.Ekoms.1 trojan. It includes functionality that allows it to take screenshots and record audio. While the screenshot activity is working just fine, Dr.Web says the trojan's audio recording feature has not been turned on, despite being included in the malware's source code. "All information transmitted between the server and Linux.Ekoms.1 is encrypted. The encryption is initially performed using the public key; and the decryption is executed by implementing the RSA_public_decrypt function to the received data. The Trojan exchanges data with the server using AbNetworkMessage."
It requires you to run a binary as root.
Simply download the package and run these steps:
1. tar xzf trojan.tar.gz ./configure
2. cd trojan
3.
4. make
5. sudo make install
-- Will program for bandwidth
Linux didn't support my laptop's webcam.
Simply download the package and run these steps:
It doesn't build with my version of libc. Is there a wiki or forum, or something?
Yeah, because there are absolutely no vulnerabilities or privelege escalation exploits on a Linux system that can be exploited as infection vector.
I was worried we'd never get in the big leagues. Linus, you can now be proud and they won't laugh at you anymore.
Dr.Web malware specialists have not disclosed how this malware infects Linux computers.
But they are willing to sell you their Linux antivirus software.
From what I've gathered, it's written in C++, uses Qt 5.4 or higher (that's when the enumeration value QStandardPaths::GenericDataLocation was added to Qt) and it's not self-propagating.
So basically, it's a program that has to be installed on your computer... maybe from a compromised package repo server.
Anons need not reply. Questions end with a question mark.
Jokes on them, my headless Linux box doesn't have a microphone. I will go back to playing my xbox1 on my Samsung tv while asking Siri for game pointers...
sorry for my comments, I'm drunk
for bsp in range(0,28):
print("^H")
I can break this thing by entering runlevel 3, deleting its ~/.config/autostart entry, and restarting X? And check for it by... looking for it there?
Or at the very worst, by rebooting to single-user and doing this?
but why did they make a new name for it? "teamviewer" is much easier to remember.
Despite the presence of an audio recording feature in its codebase, Dr.Web says that this functionality was never active in the trojan's normal operation.
Now I lost any hope my microphone will ever work. If even hackers have a hard time ...
Wait, so someone has found a way to make audio work reliably across Linux distros? Does this make 2016 the Year of the Linux Desktop?
Virtually serving coffee
Well at least someone figured out how to get audio working on Linux
It's from an antivirus peddler and has the word "virus" in the URL, lol. Yeah, not clicking that.
even with wayland?
Linux rootkits have been around for many years, and there is already standard functionality for taking screenshots and recording audio built in to most linux distros.. You can just dd data from /dev/audio to a file, and you can take screenshots using xwd or import. The only difference is that most linux systems are servers or embedded so they usually don't have X11 running or any audio hardware attached.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
> Yeah, because there are absolutely no vulnerabilities or privelege escalation exploits on a Linux system that can be exploited as infection vector.
You must be a bit dense, so here's for you (read *really* slowly): the point is not that there aren't Linux vulnerabilities. There are quite a few at each point in time. The point is that this one either isn't a vuln at all (they don't tell us) or if it is, it's over-inflated.
Outrageous marketing claims do far more harm than good in this sector, so it's absolutely essential that those so-called "security experts" get a good public spanking when they are caught doing this (I'd prefer the spanking to be physical, but most of my colleagues never liked my tastes, so I'll shut up).
Well of course the source code is provided, no Linux user is going to install something without first knowing what it does!
Summation 2
as they haven't disclosed how you get infected, i see this as the usual antivirus maker ploy of trying to increase sales by scare stories with nothing to back it up.
"The hands that help are better far than lips that pray." - Robert Ingersoll (1833-1899)
I just read the source code, it's only a mere 18KiB python package that does nothing wrong, except having a shedload of "TODO"s.
Interesting piece if anyone wants to learn a thing or two about DBus.
posting as AC to preserve mods
Nah, easier to download and install the compiled binary package. No compile stuff.
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
You are literally the only one saying that here.
as they haven't disclosed how you get infected, i see this as the usual antivirus maker ploy of trying to increase sales by scare stories with nothing to back it up.
It's a trojan. Not a virus.
If you don't understand how you get infected with a trojan, or maybe even why it is called 'trojan', please leave Slashdot and never come back.
> It has been repeated over and over that malware only exists on Windows
Quotation needed.
Over the years I have met dozens of users that run as root. Even on systems such as Ubuntu they re-enable the root account for daily use. This could be an issue to users like these. They do this as they are Windows refugees and don't like being asked for their password all the time, there are tons of people that do this in Vista and up on Windows by disabling UAC as well. A system is only as secure as you (the operator) make it.
http://it.slashdot.org/comment...
has detected a new threat against Linux users
What, all twelve of them?
I suppose you are using a windows phone or surface rt and are puzzled as to why there are more Linux users in the world than WP OS and WInRT users combined? I give the guys at DrWeb credit for trying to make money from us skin flint Linux users. Considering the fact that Mint Linux is starting to really catch on and has more users than WP OS and Surface RT users combined and it is only one distro that has millions of users. The fact that old computers and laptops are easily made to efficiently work by the millions in a large part because of Linux, your troll is starting to wear a little thin, and many people know it.
The truth is Windows is quickly becoming irrelevant on the home desktop because of the blatantly obvious planned obsolescence built into Windows. Hell I have a 6 year old atom 512 dual core 64 mini desktop with 4 gig of ram and it runs 7 fine. But is not compatible of running Win 10 and this is by design! When 7 goes for a shit and loses support I am almost willing to bet that most hardware that has been obsoleted by Microshaft will run the latest linux kernel and destops just fine.
Same goes for my old T42 non pae laptop which still gets 4-5 hours on a nine cell. All you have to do is know which kernel to run and bingo you can even run non PAE 32 mode procs on Linux...TRY THAT with windows! Stop trying to obscure the truth and spread bullshit about linux desktop distros, they are stellar at keeping the best gear from being thrown in the garbage dump and more and more people are starting to realize the truth about how advanced and flexible linux has really become in the past 15 years or so.
So I don't blame the antivirus snake oil salesmen for trying to get on the band wagon because Windows is more secure only because most people who hose their old gear just trash it after Windows obsoletes it. The whole desktop computer industry is changing and there is starting to be a large market for Linux because of the way it can keep gear going.
TODO
-Ncurses support
This trojan doesnt work with pulseaudio..... well technically NOTHING works with pulseaudio.
So I want them to write and push out a patch so it will work with not just ALSA but the other 657 different audio interface API's.
Do not look at laser with remaining good eye.
And on Windows you simply download trojan.zip, unzip it and run the setup.exe. Of course, you probably just have to download and run a setup.exe, but that's the point: it does not say it's a trojan even if you have to compile it with many dependencies (which do not include libtrojan and libmalware).
where on earth did i say it was a virus, dickhead? or shall i change "infected" to "deployed" to make your stupid nitpicking mind happier?
"The hands that help are better far than lips that pray." - Robert Ingersoll (1833-1899)
Its a post PC world. Android is Linux based, iOS uses UNIX and you keep a PC around to use as what? A boat anchor?
I don't think it runs on anything except a 5 year old ubuntu with default setup and you need to kill pulseaudio + make sure your microphone is alsa device 0:1 for the experimental recording function. Also try disabling compositing, if your screenshots only show the desktop background.
You might have to create the certs for the encrypted uploads manually if the system isn't getting enough entropy fast enough or the Trojan will assume that the connection timed out and go into an endless loop.
Just run the Windows version with wine until the devs get their shit together!
Windows has a convenient feature where it will download AND run the Trojan for you.
There was a Linux kernel vulnerability announced yesterday... Ubuntu had the patch available by the time I got out of work. Phones, on the other hand are Phucked.
How does this Linux.Ekoms.1 trojan get onto the computer without the end user explicitly downloading and installing it.
And you use what? A phone for banking, etc? I don't think there is a phone or tablet out there that isn't compromised before it leaves the factory.
Yeah, thanks for proving me right because that's not what he said either.
You should learn how to read before you start writing.
I (maybe shockingly) actually read the page.
FTP
~
EkomsCcClient:
It generates a filtering list for the "aa*.aat", "dd*ddt", "kk*kkt", "ss*sst” files that are searched in the temporary location and uploads the files that match these criteria to the server. If the answer is the uninstall line, Linux.Ekoms.1 downloads the /tmp/ccXXXXXX.exe executable file from the server, saves it to the temporary folder and runs it.
~
Last time I check unless you are running Wine, ccXXXXXX.exe will not execute in linux or have my years of use clouded my judgment?
I usually sit on a ton of mod points - this is +5 funny material here.
Honesty may be the best policy, but by process of elimination, dishonesty is the second best policy.
On xterm too?
Old school here. I access our Unix-like systems exclusively using Cygwin terminal which emulates xterm. At home I have Mac OS and FreeBSD. The latter one is a file server which I access mostly though a terminal.
I hadn't the slightest objection to his spending his time planning massacres for the bourgeoisie... (P.G. Wodehouse)
where on earth did i say it was a virus, dickhead? or shall i change "infected" to "deployed" to make your stupid nitpicking mind happier?
Hey, hey, why don't you go somewhere else, say, Foxnews.com, and troll there? People like you make commenting on the Internet a routine of name calling and insults. Pretty sad that because of "Dickheads" like you, with a "stupid nitpicking mind" you have to ignore the comment sections on so many websites. Go, get a life.
upskirt.viewer is more likely to be clicked.
Sent from my ASR33 using ASCII
Oh, Wait ...
Sent from my ASR33 using ASCII
Well maybe if you are running a debian, but for the redhats the rpm fails. I think it is a problem with dnf, cam anyone try with yum?
This kind of information TOTALLY USELESS unless the fear mongers in question actually tell us how this thing gets on a system. That's very important because it tells us how to AVOID this stuff. That's the whole point of ANY sort of problem report even if you're just talking about an unsupported printer.
Vague accusations are of no use to anyone except trolls.
How do you defend against this? How do you fix whatever security hole it's using?
The nature of the infection vector is really the only bit of relevant information and it seems to be missing.
A Pirate and a Puritan look the same on a balance sheet.
For those who are worried about the suboptimal performance of the trojan due to the asymmetric key encryption scheme: Apparantly, it uses AES for the encryption once it successfully obtains the symmetric key from the server. It would be great if they add support for other key distribution schemes as well.
On the loaded OS, run a full scan of all disk partitions using the Dr.Web Anti-virus for Linux.
/tmp/ccXXXXXX.exe executable file from the server, saves it to the temporary folder and runs it.'
How about 'kill -9 PID'
BTW: Anyone notice it also 'downloads the
Don't think drweb knows enough about *nix to even explain what it does.
Is this trojan under the GPL? If so, can somebody direct me to the git repo???
oh, I already got infected with the ./configure step
Malware did not install as root, did not need to. Just took all my thunderbird adresses and mailed all my contacts to try this awesome software.
Atari rules... ermm... ruled.
OH! Whew!
The truth is that Windows 10 boasts a number of installations that loonix losers couldn't dream in a million years. The battle for the desktop is long past and loonix losers showed up armed with snowballs at a tank fight.
LOL Win 10 is a suck ass disto from Microshaft that cannot even play a DVD without installing VLC! What a piece of shit if you like to watch old DVDs or if you have gear that is older. I was on the tech preview and when the release came the assholes removed all sorts of features and regressed the audio api. And Cortana is an absolute piece of shit it sucks dead horse balls with conexsant HD mikes and chips that are not even 4 years in the making for shits sake! Whereas Intel HD audio, web cam, and even firewire works without a hitch on my newer Lenovo T500 with Linux.
In contrast on the same laptop the fucking AMD graphics are not even supported properly and the 7 drivers are completely bjorked so I have to switch back to shitty intel graphic because it has both. But the radeon drivers in linux Xorg work perfectly! So don't give me bullshit about how great windows 10 is, the assholes in Redmond have their fingers up their collective assholes and they are hell bent on filling the worlds garbage dumps with old computers. They could easily repack an older OS like 7 and update it and sell it to people who have older gear and have it work with older drivers but instead the new shiny "all your files are belong to the cloud" bullshit OS is what they are peddling.
You need to download the Android SDK, then compile, load certificate on target and finally deploy on target.
Then, when the unsuspected owner returns from taking a piss, target is p0wned*. Enjoy!
* support up to Android 2.1 only
What I can't understand is why someone who apparently knows everything already should trouble to read a forum such as Slashdot - let alone comment, and abuse those who do not enjoy their educational advantages.
If Slashdot isn't a place where people can discuss matters in a calm, civilized way, and learn from each other, what is it? (That's a rhetorical question, by the way).
I am sure that there are many other solipsists out there.
what point? he/she totally missed my point that its about anti virus maker trying to makes sales with crap information. i couldn't care if its a trojan or virus, if you can't say how it gets onto a machine, then your case for it being a problem seems very bogus. Virtually all antivirus suppliers have come up with crap scare stories to get linux users to buy their product.
"The hands that help are better far than lips that pray." - Robert Ingersoll (1833-1899)
who cares what an AC has to say? you go get a life or have the balls to at least register yourself
"The hands that help are better far than lips that pray." - Robert Ingersoll (1833-1899)
I dunno man, there's a bunch of unsupported compiler options and I end up with an a.out. This is frustrating!
WHAT!???
.
.
.
.
*They* wrote it.
Trouble is, wine doesn't emulate low level Windows driver stuff that trojans rely upon. Maybe trojan authors should band together and sponsor appropriate wine development?
If Slashdot isn't a place where people can discuss matters in a calm, civilized way, and learn from each other, what is it? (That's a rhetorical question, by the way).
Thanks. I needed a good laugh!
Holy serendipity, Batman! I took a break due to frustration with my computer to read /.. I was trying to take screenshots to make a tutorial and couldn't figure out why I was only getting the background.
I knew the Linux was a joke to use
Well, it'll come in the same way any malware does - through an infection vector. For Linux, it probably comes in through commercial software piracy (yes, Linux has commercial software) via warez or cracks or keygens, or even stuff like WordPress themes that people actually pay money for.
So for Linux, as long as you stick with your distro's repos (that aren't compromised - but given these days packages are signed it'll be hard) or source code, you're fine. But start downloading commercial software for free and stuff, well...
Why in the world would somebody write a trojan to build a collection of neckbeard headshots? That's just sick!
where on earth did i say it was a virus, dickhead? or shall i change "infected" to "deployed" to make your stupid nitpicking mind happier?
Wow, you just totally missed his point. You asked about " how you get infected"? It's a Trojan. You "get infected" by voluntarily running the software that you think is something else. It's not some virus that embeds itself in an email, webpage, or text editor document and then relies on some exploit to run automatically without your knowledge. The infection mechanism is implicit in the word "trojan".
FTFY
I don't see any mention of a securty hole at all, do you?
Likely it's a trojan that runs if you install it first (after typing in your sudo password).
That's generally how things work on Linux.
How do you defend against this? How do you fix whatever security hole it's using?
The answer to both of these questions is the same. Buy our (not mine personally, the people who put out this report) antimalware software.
End of Line.
Linux turned me into a gnute!
I got better...
This is supposed to be a major issue with X. X lets any client read all input sent to the X server, view any window, etc. These aren't bugs in X, it's how it's designed.
Wayland doesn't allow this behavior so probably such a trojan wouldn't be possible with Wayland (outside of the audio aspect that is).
you need to google teamviewer. it's the most widely spread backdoor in the world. (on gnu/linux it runs as a background daemon even if you don't manually turn it on. it does not (easily) let you disable the daemon and use it ad hoc. on OS X, you can't even uninstall it without leaving crap behind)
The world authority (not) has just spoken. He is the master of all things mystical and the fountain of all knowledge with the perfect sampleset (sarcasm) for all things! When he speaks in absolutes for everyone you know it must be true (yea, right). He is the all-knowing and all-seeing ultimate word on everything (sarcasm). When he voices his views he is the ultimate last word (not) since he is smart and everyone else is stupid by comparison.